Legal
GDPR & Cookie Policy
Last updated: September 15, 2026
Your rights
If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):
Right of access (Article 15)
You can request a complete copy of all personal data we hold about you, including how it is processed and who it is shared with.
Right to rectification (Article 16)
You can request correction of any inaccurate personal data we hold about you. You can also update most account data yourself in Settings - Profile.
Right to erasure (Article 17)
You can request deletion of your personal data. You can delete your account and associated data at any time via Settings - Danger zone. Note: transaction records required for legal obligations may be retained for 7 years.
Right to data portability (Article 20)
You can request a machine-readable export of your personal data and projects. Use Settings - Danger zone - Export your data, where available, or submit a request below.
Right to restriction (Article 18)
You can request that we restrict processing of your data in certain circumstances, for example while a dispute about the accuracy of data is pending.
Right to object (Article 21)
You can object to processing of your personal data where we rely on legitimate interest as the legal basis. We will stop processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent
Where processing is based on your consent, you can withdraw consent at any time without affecting the lawfulness of prior processing.
Submit a data request
Use the form below to exercise any of your rights. We will respond within 30 days. We may ask you to verify your identity before processing the request.
Cookie policy
What we use
Cutlock uses necessary storage to operate the service. Product analytics and enhanced diagnostics are optional and remain disabled until you consent. We also run Vercel Web Analytics to measure aggregate site traffic; it sets no cookie, stores no persistent identifier, and cannot be used to identify you, so it is active at all times rather than gated behind consent. We do not use advertising cookies or advertising pixels.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| sb-[project-ref]-auth-token | Supabase authentication session | Session / 1 hour | Strictly necessary |
| sb-[project-ref]-auth-token-code-verifier | OAuth PKCE flow security | Session | Strictly necessary |
| cutlock-privacy-consent | Stores your product analytics and diagnostics choices | 1 year | Strictly necessary |
| None (Vercel Web Analytics) | Measures aggregate page views and traffic. Sets no cookie and stores no persistent identifier on your device, so it is not an optional category. | Not applicable - no storage on your device | Necessary / cookieless |
| PostHog browser storage | Measures product usage only after product analytics consent | Up to 1 year | Optional analytics |
| _ga, _ga_* | Google Analytics - distinguishes users and sessions, only set after product analytics consent. Google Signals and ad personalization are disabled, so this cookie is not used for advertising. | Up to 2 years | Optional analytics |
| Sentry browser storage | Supports masked session replay only after enhanced diagnostics consent | Session | Optional diagnostics |
What we do not use
- Advertising cookies or advertising pixels of any kind
- Facebook Pixel or advertising network cookies
- Google Signals or Google Ads audience linking
- Unmasked user behaviour recording tools
- Third-party chat widgets that set cookies
Managing cookies
Use the Privacy settings button available on every page to accept, reject, or change either optional category at any time. Withdrawing consent stops future optional collection, clears the local PostHog identity when applicable, and disables further Google Analytics measurement in your browser. Necessary authentication and consent storage cannot be disabled in this panel. You can block all cookies in your browser, but doing so will prevent account login.
Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (UODO in Poland) within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
Data Protection Officer
Cutlock currently operates below the threshold requiring a mandatory Data Protection Officer appointment. The responsible person for data protection matters is:
Jakub Bandzarewicz
Żory, Poland
jacob@voidx.pl
Supervisory authority
You have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for Cutlock is:
Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl
kancelaria@uodo.gov.pl